d2bb01842e2c9294198454c24c39bb42c0d43af3a1850cdc8564bd17969ccf90

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea87324e6d6413ccc7cba2f9445c951b_JaffaCakes118.html
Size

58KB
MD5

ea87324e6d6413ccc7cba2f9445c951b
SHA1

f1764a1e62a3558aa6722e52ccb45895a1b4a962
SHA256

d2bb01842e2c9294198454c24c39bb42c0d43af3a1850cdc8564bd17969ccf90
SHA512

973c2dcfd57be8c179ea152ff645cd8aaf606c5dc4d7e5af5adda3e12ffa5973d0b6ceaf9495b2abb574f8b45ef411fcc0248a03d0ec33ba61be6ece2134ef3d
SSDEEP

1536:gQZBCCOdS0IxCMYFdfBfLfxfqfUfffLfNfHfxfBf2fufYfsfZfLfjfWf7fffOf5t:gk280IxEpjZycHDl/Z5Omg0BzL+DXWBt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
1188	msedge.exe
1188	msedge.exe
4664	identity_helper.exe
4664	identity_helper.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 3260	1188	msedge.exe	83
PID 1188 wrote to memory of 3260	1188	msedge.exe	83
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3068	1188	msedge.exe	84
PID 1188 wrote to memory of 3240	1188	msedge.exe	85
PID 1188 wrote to memory of 3240	1188	msedge.exe	85
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86
PID 1188 wrote to memory of 3116	1188	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea87324e6d6413ccc7cba2f9445c951b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90de746f8,0x7ff90de74708,0x7ff90de74718
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,15741479271743826144,16591055827376970278,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
9eb472d9f3f0faf89a45b0fde24f2a78

SHA1
2372bf7721bafb5f1feb19224736ae63d0ac5bbe

SHA256
9659c976dba5e27435d3f37f3b07fe077f54452d66441c187d5e33daac8c56fc

SHA512
244895b64c5051c5a5f91510d0dc016090e922b950dc5365d2efb0202d840af3b9e65e65ba492b4698a8cad118a63179a28e703ca730cca0b05973cb558ba1e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
64dc76ef8dce657b39a4fac057117ae0

SHA1
92086f4be49ab93203f583833d378e59796fe8f7

SHA256
aaed7e6fe5535cc6c42ea69b1942a0e983225712c1a6577ea86735f8702a65d6

SHA512
044591db4c88d7a00281b8ff4a703ac00738a9e2093a2ba5ea10964beaf3f3172d9d437d8697e8d0ed5226521e8264816cd73528506db06fd2c8bf1a92767d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50e2cb8a4a9b7b18d08dfc3a0394798d

SHA1
f3ba93d2f8e12680b4771b8d39a4600017e2ff5c

SHA256
1b2c7f5280178f8dea98911ecb9d00d088cd4b56e4bb4c9c52b9fb94b62129d6

SHA512
ae9faa918a0f6426cd3f184f14275fc249b1b51f7c9b9f7434aa1724d700496d283e3982ef6085e319cba8a7a5f3d1d5bfa1fd65043f3164d946704a23ff2730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ecf73309e8b95eb4e6e60537978a2d7

SHA1
9e36db3b13b8642100d7af66232926b0bee4eece

SHA256
3ff45c6a1f3b3e149e65cd5f93b7c82781b02e5fefc1754875b2bb2451139fdf

SHA512
2ae2d31dcaeea0b7cc1e227f70130ba6cf8b1bc108a9102ce5da8679bfc6b1f0710c720227b25991a6b2978e92b3038eb1ca5145041b37aef35cef44ec28353c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c5b8d3167e641512893d43af204d1eb

SHA1
519a10a38e8970512fdc8562c29ae1577e0925fa

SHA256
4c6bdc6e2074ad925ebc6a45da4b7b0df97b4bfa5a1073e134274c7aafe681b1

SHA512
287c4c5665159ed898d2fed455970c8dda259653577722139ea8d52d862a1783a879546aa787696ad4b6421c23f8a9597aca17bb510746a2ea7c54f5a3d1b3b0

Download Submit